For fuzzing to be effective you need access to coverage information. If you have the RTL (SystemVerilog or VHDL source) you can verify that you're hitting all t

For fuzzing to be effective you need access to coverage information. If you have the RTL (SystemVerilog or VHDL source) you can verify that you're hitting all the paths and the branches, and use a constraint solver to find paths that increase coverage. If you just have the registers and latches you can see how much of the state you've reached. But if you just have a chip too much of the internal state is unreachable: you'll never find the magic sequence that triggers the badness (if it exists) by random simulation, the heat death of the universe will happen first.